Page 4 of 47 results (0.003 seconds)

CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0

CVE-2022-1901

https://notcve.org/view.php?id=CVE-2022-1901

19 Aug 2022 — In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. En versiones afectadas de Octopus Deploy es posible desenmascarar variables confidenciales usando la visualización previa de variables. • https://advisories.octopus.com/post/2022/sa2022-09 • CWE-269: Improper Privilege Management •

CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2022-30532

https://notcve.org/view.php?id=CVE-2022-30532

19 Jul 2022 — In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy. En las versiones afectadas de Octopus Deploy, no se presenta registro de los cambios en los artefactos dentro de Octopus Deploy. • https://advisories.octopus.com/post/2022/sa2022-08 •

CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0

CVE-2022-29890

https://notcve.org/view.php?id=CVE-2022-29890

15 Jul 2022 — In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. En las versiones afectadas de Octopus Server la barra lateral de ayuda puede ser personalizada para incluir una carga útil de tipo Cross-Site Scripting en el enlace de soporte • https://advisories.octopus.com/post/2022/sa2022-07 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0

CVE-2022-1881

https://notcve.org/view.php?id=CVE-2022-1881

15 Jul 2022 — In affected versions of Octopus Server an Insecure Direct Object Reference vulnerability exists where it is possible for a user to download Project Exports from a Project they do not have permissions to access. This vulnerability only impacts projects within the same Space. En las versiones afectadas de Octopus Server se presenta una vulnerabilidad de Referencia Directa de Objetos Insegura donde es posible que un usuario descargue Exportaciones de Proyectos desde un Proyecto al que no presenta permisos para... • https://advisories.octopus.com/post/2022/sa2022-06 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2022-1670

https://notcve.org/view.php?id=CVE-2022-1670

19 May 2022 — When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users. Cuando es generado un código de invitación de usuario en Octopus Server, la comprobación de este código puede establecerse para un número específico de usuarios. Era posible omitir esta restricción de comprobación para crear cuentas de usuario adicionales p... • https://advisories.octopus.com/post/2022/sa2022-04 •

CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2022-23184

https://notcve.org/view.php?id=CVE-2022-23184

07 Feb 2022 — In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server will allow open redirects. En las versiones de Octopus Server afectadas, cuando los enlaces HTTP y HTTPS del servidor están configurados en localhost, Octopus Server permitirá las redirecciones abiertas • https://advisories.octopus.com/post/2022/sa2022-02 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-26556

https://notcve.org/view.php?id=CVE-2021-26556

07 Oct 2021 — When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access. Cuando Octopus Server se instala usando una ubicación de carpeta personalizada, las ACL de carpeta no se establecen correctamente y podrían conllevar a que un usuario no privilegiado use una carga lateral de DLL para conseguir acceso privilegiado • https://advisories.octopus.com/adv/2021-01---Local-privilege-escalation-in-Octopus-Server-%28CVE-2021-26556%29.1733296189.html • CWE-426: Untrusted Search Path •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-31820

https://notcve.org/view.php?id=CVE-2021-31820

18 Aug 2021 — In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in plaintext in the UI. En Octopus Server después de la versión 2018.8.2, si el Proxy de Peticiones Web de Octopus Server está configurado con autenticación, la contraseña es mostrado en texto plano en la UI. • https://advisories.octopus.com/adv/2021-07---Proxy-Password-Stored-in-Plaintext-%28CVE-2021-31820%29.2193063986.html • CWE-312: Cleartext Storage of Sensitive Information •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-16197

https://notcve.org/view.php?id=CVE-2020-16197

25 Aug 2020 — An issue was discovered in Octopus Deploy 3.4. A deployment target can be configured with an Account or Certificate that is outside the scope of the deployment target. An authorised user can potentially use a certificate that they are not in scope to use. An authorised user is also able to obtain certificate metadata by associating a certificate with certain resources that should fail scope validation. Se detectó un problema en Octopus Deploy versión 3.4. • https://github.com/OctopusDeploy/Issues/issues/6529 • CWE-295: Improper Certificate Validation •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2019-15698

https://notcve.org/view.php?id=CVE-2019-15698

27 Aug 2019 — In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10. En Octopus Deploy 2019.7.3 a 2019.7.9, en determinadas circunstancias, un usuario autenticado con permisos VariableView podría ver valores confidenciales. Esto se fijó en 2019.7.10. • https://github.com/OctopusDeploy/Issues/issues/5810 •